EP3522006A1 - Verfahren zum schuetzen von ausfuerbaren code - Google Patents
Verfahren zum schuetzen von ausfuerbaren code Download PDFInfo
- Publication number
- EP3522006A1 EP3522006A1 EP18305105.1A EP18305105A EP3522006A1 EP 3522006 A1 EP3522006 A1 EP 3522006A1 EP 18305105 A EP18305105 A EP 18305105A EP 3522006 A1 EP3522006 A1 EP 3522006A1
- Authority
- EP
- European Patent Office
- Prior art keywords
- executable code
- sequences
- code
- portions
- collection
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Withdrawn
Links
- 238000000034 method Methods 0.000 title claims abstract description 25
- 238000012546 transfer Methods 0.000 claims abstract description 9
- 230000001131 transforming effect Effects 0.000 claims abstract description 8
- 230000006870 function Effects 0.000 description 5
- 230000004224 protection Effects 0.000 description 4
- 230000009466 transformation Effects 0.000 description 4
- 230000008901 benefit Effects 0.000 description 3
- 230000008859 change Effects 0.000 description 2
- 230000000694 effects Effects 0.000 description 2
- 238000004891 communication Methods 0.000 description 1
- 230000001419 dependent effect Effects 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 238000001514 detection method Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000002265 prevention Effects 0.000 description 1
- 238000012360 testing method Methods 0.000 description 1
- 230000001960 triggered effect Effects 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
- G06F21/12—Protecting executable software
- G06F21/14—Protecting executable software against software analysis or reverse engineering, e.g. by obfuscation
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F8/00—Arrangements for software engineering
- G06F8/40—Transformation of program code
- G06F8/52—Binary to binary
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
- G06F9/30003—Arrangements for executing specific machine instructions
- G06F9/3005—Arrangements for executing specific machine instructions to perform operations for flow control
- G06F9/30054—Unconditional branch instructions
Definitions
- the present invention relates to the field of software protection, and more particularly of obfuscation techniques. It relates particularly to methods of protecting a software component by transforming its executable code.
- Such applications may run on various devices, mobile or not, such as desktop computers, laptops, point of sale terminals or smartphones. They may run locally or be implemented across a network like a LAN or the Internet.
- Software applications may be run in unsecured environments where an attacker may gain some control (or even full control) of the operation of the system running the application. Consequently, secure applications need to implement some security mechanisms in order to protect data handled by the application from being read or modified by an attacker.
- a hacker may try to understand the operation of a software component by reverse-engineering of the compiled code executed by the system. He may then access secure information handled by the software and/or modify the software in order to perform malicious operations.
- a reverse-engineering is usually performed using tools, such as code analyzers and debuggers, that extract, from a compiled code, information about the operations of the code, such as a control flow graph describing the order of execution of instructions in the code.
- tools such as code analyzers and debuggers, that extract, from a compiled code, information about the operations of the code, such as a control flow graph describing the order of execution of instructions in the code.
- obfuscation software protection techniques
- deobfuscator tools have been developed. Such tools make it possible to circumvent most of the protections put in place by the traditional techniques of obfuscation.
- the invention aims at solving the above mentioned technical problem.
- An object of the present invention is a method for transforming an executable code.
- the method comprises a step of identifying a set of portions of the executable code to be replaced.
- the method comprises a step of automatically analyzing the executable code and identifying a collection of sequences of instructions that end in an unconditional transfer of control, said sequences being included in the executable code only.
- the method comprises a step of generating an updated executable code by replacing each of said portions by an entity which may be either an indirection to one of said sequences or a series of indirections to sequences of the collection, the entity providing an equivalent functionality to that of the portion it replaces.
- the method may comprise a step of inserting a dead code in the executable code when generating said executable code wherein at least one of said sequences belongs to the dead code.
- sequences may be Return Oriented Programming gadgets.
- sequences may be Jump Oriented Programming gadgets.
- Another object of the invention is a device including a non-volatile memory storing the updated executable code generated according to the invention.
- Another object of the invention is a system for transforming an executable code in which a set of portions to be replaced has been identified.
- the system comprises a processor and a software application configured to automatically analyze the executable code and to identify a collection of sequences of instructions that ends in an unconditional transfer of control, said sequences belonging to the executable code only.
- the software application is configured to generate an updated executable code by replacing each of said portions by an entity which may be either an indirection to one of said sequences or a series of indirections to sequences of the collection, the called entity providing an equivalent functionality to that of the portion it replaces.
- the software application is executed by the processor.
- the software application may be configured to check whether the collection of sequences is sufficient to perform replacement of all the portions of the set and to insert a dead code comprising the missing sequences in the executable code.
- sequences may be Return Oriented Programming gadgets or Jump Oriented Programming gadgets.
- a first aspect of the invention is an obfuscation method for transforming a compiled software code before its execution.
- a securing method is performed by a system treating the compiled software code comprising many computer code instructions.
- the system generates an updated executable code from the original executable code.
- the updated executable code is more robust to reverse-engineering attacks.
- both the original executable code and the updated executable code provide the same results (i.e. services delivered to the calling entity) when running.
- both the original executable code and the updated executable code are functionally equivalent.
- the updated executable code is intended to be executed on an execution device similar to the one which can run the original executable code.
- the execution device may be a PC, a smart card, a secure element, a mobile device such as a smartphone or a tablet, a public terminal in a point of sale or any computer machine targeted by the compiler used to generate the original executable code.
- the system is a securing device which may be any electronic device including a hardware processor and a memory.
- a hardware processor for example it may be a personal computer on which a development environment was installed.
- Figure 2 describes an exemplary embodiment of such a system 30 comprising a processor 50, and a software application 40 stored in a non-volatile memory 60 of the system 30.
- the system 30 may include a volatile memory (ex: RAM), a communication unit such as an Ethernet or Wi-Fi network adapter, a display and user input means like a keyboard and a mouse.
- the system 30 stores the software code 10 (i.e. executable code) to be secured.
- the updated software code 20 i.e. updated executable code obtained after transformation by the system 30 can also be stored in the non-volatile memory 60 of the system 30.
- Figure 3 shows a flow chart of the transformation of the executable code 10 according to an example of the invention.
- the executable code 10 is stored in the memory 60 of the system 30 as described at Figure 2 .
- a plurality of portions of original executable code 10 are identified. Each portion contains at least one executable instruction. The identified portions are gathered in a set. The selection of these portions is carried out using predefined rules. For instance, the portions may focus on critical or sensitive parts of the executable code 10. The portions may focus on the parts of the executable code 10 that are most (or least) frequently executed in usual/nominal operation. The portions may also be selected at random.
- references of each portions of the set are stored in the memory of the system 30.
- the system 30 analyzes the executable code 10 and identifies a collection of sequences of instructions that end with an unconditional transfer of control. More precisely, the system 30 searches for sequences whose execution provide an effect (i.e. result) equivalent to execution of the portions of the set.
- the system 30 may also search for a sequence functionally equivalent to execution of part of a portion. For instance if an identified portion comprises 3 instructions, the system 30 can find two sequences allocated to this identified portion: one sequence corresponding to the two first instructions of the portion and another sequence corresponding to the last instruction of the portion.
- CALL and RET Return
- JUMP and/or BRANCH are such instructions (but not limited to, as it is dependent of the instruction set of a given processor architecture).
- step S24 the system 30 checks if the collection contains all sequences required to treat every portions of the set.
- a dead code 12 is an executable code which is never triggered when running the original executable code. Such a dead code 12 can be scattered at several places in the executable code.
- the dead code 12 may look like a usual executable code.
- the system 30 may decide not to replace the portions for which no corresponding sequence has been found in the original execution code 10. In such a case, there is no need to insert dead code in the original execution code 10.
- step S28 the system 30 generates an updated executable code 20 by replacing each of said portions by a call pointing to the starting point of execution of a sequence of the collection so that a sequence provides a function equivalent to that of the portion it replaces.
- execution of the updated executable code 20 provides final results and effects identical to those of the execution of the original executable code 10.
- a portion may also be replaced by a series of sequences belonging to the collection which creates a chain of unconditional jumps. It can be implemented as a ROP chain for example.
- steps S22 to S28 are performed by the processor 50 of the system 30 running the software application 40.
- the step S20 can be either manually carried out or performed by the processor 50.
- the system 30 may comprise both the original executable code 10 and the updated executable code 20.
- Figure 1 shows an example of executable code 10 to be transformed according to the invention.
- the executable code 10 contains a series of instructions (also named machine instructions) shown by dots.
- the executable code 10 also contains three portions P1, P2 and P3 which may comprise one or several instructions.
- the executable code 10 also contains three sequences S1, S2 and S3 which comprise several instructions.
- the sequences S1, S2, S3 have been selected to replace the execution of respectively the portions P1, P2 and P3. In this example, no dead code has been inserted in the original executable code 10. It is to be noted that the sequences may have been found at any location inside the original executable code 10. Moreover when the executable code 10 is run, these sequences can execute regardless of whether they are called in place of the corresponding portions.
- FIG. 4 shows an example of updated executable code 20 generated according to the invention.
- Each identified portion P1, P2 and P3 has been replaced with a call CS1, CS2, respectively CS3 to the corresponding sequence S1, S2 respectively S3.
- the sequences are Return Oriented Programming (ROP) gadgets.
- a ROP gadget is a small instruction sequence ending in a RET (Return) instruction and which is available in the original executable code 10 generated by the compiler (and optionally in a dead code added to the original executable code).
- Return Oriented Programming technique has been developed for hacking purpose. By combining several ROP gadgets, and thus creating a so-called "ROP chain", a hacker can perform certain tasks for conducting an attack when running an application containing the ROP gadgets. Many systems and methods for detection and prevention of Return-Oriented-Programming (ROP) attacks in applications have been developed during the last years.
- ROP Return-Oriented-Programming
- ROP attacks are implemented based on the linked shared libraries which are available according to the targeted operating system. This is due to the fact that numerous and specific ROP gadgets must be found to build such an attack.
- An advantage of the invention is to provide a deterministic solution since the sequences of the collection only depend only on the address range in memory of the executable code. In other words, the collection is self-contained vs the executable code.
- Gadget G1 Gadget G2: pop a; pop b; ret; ret; Gadget G3: Gadget G4: mul a*b; pop a; ret; pop b; ret;
- a ROP gadget can be included in several ROP chains. In other words, a ROP gadget can be used to replace several portions of the original executable code.
- the sequences are Jump Oriented Programming (JOP) gadgets.
- JOP gadget is a small instruction sequence ending in a Jump instruction and which is available in the original executable code 10 generated by the compiler.
- ROP and JOP are examples of "Branch Oriented Programming".
- a single original executable code may lead to several versions of updated executable code by using different settings. (E.g. different identified portions, different sequences allocated to a unique portion, or different chains of sequences allocated to a unique portion.)
- the invention allows changing the appearance of an executable code. Such modifications render the final executable code more complex to analyze by reverse-engineering.
- the invention When using gadget chains, the invention generates an update executable code which shows a high number of indirections to short sequences. Thanks to the invention, the targeted functions (portions) appear to be destructured since the complexity level of the control flow graph has been dramatically increased and code linearity has been broken.
- the invention when ROP gadgets are used, the invention generates an updated executable code which contains elements (ROP gadgets) which can be detected as wrong elements and rejected by security tools.
- the ROP gadgets of the generated executable code will not appear as legal control blocks and the protected control block will appear as something owning dead code after the first Ret (Return) instruction has been encountered by an analyzing tool.
- the invention helps to deceive a possible attacker.
- the effort to implement is big for an attacker because conventional tools (like debuggers) need to be dramatically modified.
- An advantage of the invention is that the developer of the original application does not need to take care of any specific design or implementation rules when developing an application.
- the invention is not restricted to applications whose executable code is stored in a single file. It may apply to any self-contained executable code even if split in several files.
- the architecture of the system 30 shown at Figure 2 is provided as examples only. This architectures may be different.
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Software Systems (AREA)
- General Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Multimedia (AREA)
- Technology Law (AREA)
- Computer Hardware Design (AREA)
- Computer Security & Cryptography (AREA)
- Stored Programmes (AREA)
Priority Applications (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
EP18305105.1A EP3522006A1 (de) | 2018-02-01 | 2018-02-01 | Verfahren zum schuetzen von ausfuerbaren code |
PCT/EP2019/051846 WO2019149630A1 (en) | 2018-02-01 | 2019-01-25 | Method for protecting an executable code |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
EP18305105.1A EP3522006A1 (de) | 2018-02-01 | 2018-02-01 | Verfahren zum schuetzen von ausfuerbaren code |
Publications (1)
Publication Number | Publication Date |
---|---|
EP3522006A1 true EP3522006A1 (de) | 2019-08-07 |
Family
ID=61868470
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
EP18305105.1A Withdrawn EP3522006A1 (de) | 2018-02-01 | 2018-02-01 | Verfahren zum schuetzen von ausfuerbaren code |
Country Status (2)
Country | Link |
---|---|
EP (1) | EP3522006A1 (de) |
WO (1) | WO2019149630A1 (de) |
Citations (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2016126206A1 (en) * | 2015-02-06 | 2016-08-11 | Huawei International Pte. Ltd. | Method for obfuscation of code using return oriented programming |
-
2018
- 2018-02-01 EP EP18305105.1A patent/EP3522006A1/de not_active Withdrawn
-
2019
- 2019-01-25 WO PCT/EP2019/051846 patent/WO2019149630A1/en active Application Filing
Patent Citations (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2016126206A1 (en) * | 2015-02-06 | 2016-08-11 | Huawei International Pte. Ltd. | Method for obfuscation of code using return oriented programming |
Non-Patent Citations (3)
Title |
---|
KANGJIE LU ET AL: "RopSteg", PROCEEDINGS OF THE 4TH ACM CONFERENCE ON DATA AND APPLICATION SECURITY AND PRIVACY, CODASPY '14, 5 March 2014 (2014-03-05), New York, New York, USA, pages 265 - 272, XP055188179, ISBN: 978-1-45-032278-2, DOI: 10.1145/2557547.2557572 * |
TANG XIAOXIAO ET AL: "On the Effectiveness of Code-Reuse-Based Android Application Obfuscation", 9 February 2017, ECCV 2016 CONFERENCE; [LECTURE NOTES IN COMPUTER SCIENCE; LECT.NOTES COMPUTER], SPRINGER INTERNATIONAL PUBLISHING, CHAM, PAGE(S) 333 - 349, ISBN: 978-3-319-69952-3, ISSN: 0302-9743, XP047404718 * |
YADEGARI BABAK ET AL: "A Generic Approach to Automatic Deobfuscation of Executable Code", 2014 IEEE SYMPOSIUM ON SECURITY AND PRIVACY, IEEE, 17 May 2015 (2015-05-17), pages 674 - 691, XP033177698, ISSN: 1081-6011, [retrieved on 20150717], DOI: 10.1109/SP.2015.47 * |
Also Published As
Publication number | Publication date |
---|---|
WO2019149630A1 (en) | 2019-08-08 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US11507671B1 (en) | Detection and healing of vulnerabilities in computer code | |
US10223528B2 (en) | Technologies for deterministic code flow integrity protection | |
RU2439669C2 (ru) | Способ предотвращения обратного инжиниринга программного обеспечения, неавторизованной модификации и перехвата данных во время выполнения | |
US10599820B2 (en) | Control flow flattening for code obfuscation where the next block calculation needs run-time information | |
US20170372068A1 (en) | Method to identify known compilers functions, libraries and objects inside files and data items containing an executable code | |
JP7154365B2 (ja) | ソフトウェアコードをセキュアにするための方法 | |
US8281290B2 (en) | Software diversity using context-free grammar transformations | |
JP2016525760A (ja) | 無関係なコードの特定 | |
US8001595B1 (en) | System, method and computer program product for identifying functions in computer code that control a behavior thereof when executed | |
US8775826B2 (en) | Counteracting memory tracing on computing systems by code obfuscation | |
EP2937803B1 (de) | Steuerflussglättung zur codeverschleierung, wo die nächste blockberechnung laufzeitinformationen benötigt | |
Shan et al. | Mobile agent protection with self-modifying code | |
CN110717181B (zh) | 基于新型程序依赖图的非控制数据攻击检测方法及装置 | |
US11256786B2 (en) | Method to secure a software code | |
CN111475168A (zh) | 一种代码编译方法及装置 | |
EP3522006A1 (de) | Verfahren zum schuetzen von ausfuerbaren code | |
JP6750674B2 (ja) | プログラム分析システム、プログラム分析方法、及び、コンピュータ・プログラム | |
EP3040895A1 (de) | System und Verfahren zum Schutz eines Geräts gegen Angriffe mittels Return Oriented Programming | |
CN103824020A (zh) | 自动实现软件程序免杀的方法 | |
Kumar et al. | A thorough investigation of code obfuscation techniques for software protection | |
US11783013B2 (en) | Protected processing of operations | |
WO2023156571A1 (en) | Protecting software | |
Sanders et al. | Developing a Zen Click Fraud Detection Framework Using Smart Contracts | |
Gordonov | The cost of preventing a buffer overflow |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PUAI | Public reference made under article 153(3) epc to a published international application that has entered the european phase |
Free format text: ORIGINAL CODE: 0009012 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: THE APPLICATION HAS BEEN PUBLISHED |
|
AK | Designated contracting states |
Kind code of ref document: A1 Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR |
|
AX | Request for extension of the european patent |
Extension state: BA ME |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: THE APPLICATION IS DEEMED TO BE WITHDRAWN |
|
18D | Application deemed to be withdrawn |
Effective date: 20200208 |